Detecting Steganography-Based Exfiltration

Steganographic exfiltration embeds stolen data in images, audio or documents and sends the carrier through a channel that would pass inspection. Statistical detection of a well-made payload is unreliable, so a practical program combines behavioural signals with simple structural checks for the cases where operators are less careful, such as appended data.

Signals at a Glance

Behavioural Signals

Start with the parts you can observe reliably. Carriers are normally large relative to ordinary web images because they hold a payload. Compare upload size by content type to what each host normally sends, and treat servers uploading images as unusual by default:

index=proxy cs_method=POST (content_type="image/jpeg" OR content_type="image/png" OR content_type="image/bmp")
| eval mb = round(bytes_out / 1048576, 2)
| stats count as uploads sum(mb) as total_mb avg(mb) as avg_mb max(mb) as max_mb dc(dest_host) as hosts by src, user
| lookup server_inventory src OUTPUT role
| where (max_mb > 5 AND uploads > 3) OR (role="server" AND uploads > 0)
| sort - total_mb
``` tune/validate: marketing and design hosts upload large images legitimately; scope or allowlist them ```

Tool execution is the second behavioural angle. Common utilities include steghide, OpenStego, Invoke-PSImage style scripts and custom Python using PIL. Their presence on a server is rarely benign:

title: Steganography Tool Or Script Execution
logsource:
  category: process_creation
detection:
  tool_names:
    Image|endswith:
      - '\\steghide.exe'
      - '\\openstego.exe'
      - '\\outguess.exe'
  script_patterns:
    CommandLine|contains:
      - 'Invoke-PSImage'
      - 'steghide embed'
      - 'openstego embed'
  condition: tool_names or script_patterns
level: medium
# tune/validate: expect near-zero benign hits in most enterprises; verify with software inventory

Structural Checks on Captured Files

When a proxy or mail gateway can extract files, a simple check catches careless carriers: data appended after the format’s end marker. This script reports JPEG and PNG files with trailing bytes, which are worth a human look:

# Defensive triage: report images with data after the end marker.
# tune/validate: run on files extracted from proxy or mail gateway captures only.
import sys, pathlib

JPEG_EOI = bytes.fromhex("ffd9")
PNG_IEND = b"IEND"

def trailing_bytes(path):
    data = pathlib.Path(path).read_bytes()
    if data[:2] == bytes.fromhex("ffd8"):
        end = data.rfind(JPEG_EOI)
        return len(data) - (end + 2) if end != -1 else None
    if data[:8] == bytes.fromhex("89504e470d0a1a0a"):
        end = data.rfind(PNG_IEND)
        return len(data) - (end + 8) if end != -1 else None
    return None

for p in sys.argv[1:]:
    extra = trailing_bytes(p)
    if extra and extra > 64:
        print(f"{p}: {extra} bytes after end marker")

• Embedded thumbnails and metadata can produce small false positives, so use a threshold and review the extra bytes.
• LSB and transform-domain payloads leave no trailing data. Do not claim coverage you do not have; rely on behaviour and context there.
• Re-encoding images at the gateway, such as re-compressing uploads, destroys most naive embeddings and is a preventive control for high-risk egress.
• Pair every structural hit with destination and process context before escalating.